Research map / Adversarial robustness and security / Certified and empirical robustness
Revisiting Residual Networks for Adversarial Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace the basic residual block with a bottleneck block (ablation) | Residual networks · CIFAR-10 and CIFAR-100 | CW40 robust accuracy: 54.52 -> 55.07; 27.24 -> 28.61 | Helped |
| Add aggregated convolution to the bottleneck block (ablation) | Pre-activation bottleneck · CIFAR-10 and CIFAR-100 | CW40 robust accuracy: 55.07 -> 55.53; 28.61 -> 28.80 | Helped |
| Add hierarchical convolution to the aggregated bottleneck (ablation) | Aggregated bottleneck · CIFAR-10 and CIFAR-100 | CW40 robust accuracy: 55.53 -> 56.94; 28.80 -> 29.65 | Helped |
| Add residual SE to the hierarchical bottleneck (ablation) | Robust residual block · CIFAR-10 and CIFAR-100 | CW40 robust accuracy: 56.94 -> 57.78; 29.65 -> 29.91 | Helped |
| Use standard SE instead of omitting SE (ablation) | Bottleneck residual block · CIFAR-10 | CW40 robust accuracy: 55.07 -> 54.52 | Hurt |
| Use residual SE instead of omitting SE (ablation) | Bottleneck residual block · CIFAR-10 | CW40 robust accuracy: 55.07 -> 56.05 | Helped |
| Prefer deep, narrow networks over wide, shallow networks at a fixed FLOP budget (ablation) | Residual networks · CIFAR-10 | CW40 robust accuracy: null | Helped |
| Use RobustResNet architecture and scaling instead of the strongest listed baseline at each capacity | RobustResNet · CIFAR-10 and CIFAR-100 | AutoAttack robust accuracy: CIFAR-10: 52.90 -> 54.42, 53.23 -> 55.49, 52.63 -> 55.84, 52.80 -> 56.29; CIFAR-100: 25.27 -> 26.75, 26.31 -> 27.68, 26. | Helped |
| Apply RobustScaling rather than standard WRN scaling | WRNs · CIFAR-10 | CW40 robust accuracy: ∼2% improvements | Helped |
| Use smooth activations under advanced adversarial training rather than ReLU (ablation) | Residual networks · CIFAR-10 | AutoAttack robust accuracy: null | Mixed |
Closest papers by meaning
- Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks (NeurIPS 2021 · similarity 0.93)
- When NAS Meets Robustness: In Search of Robust Architectures Against Adversarial Attacks (CVPR 2020 · similarity 0.92)
- Robust NAS under adversarial training: benchmark, theory, and beyond (ICLR 2024 · similarity 0.90)
- ROME is Forged in Adversity: Robust Distilled Datasets via Information Bottleneck (ICML 2025 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Vision Transformers Beat WideResNets on Small Scale Datasets Adversarial Robustness (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.